Proper way to manage privileged admin groups for two trusted Active Directory forests?

Question

The scenario is:

There are two domains (DomA and DomB) with a trust relationship. The relationship is forest wide with the exception that DomA can access resources in DomB, but users in DomB should not have access to DomA.

In Domain A, there are default groups: Domain Admins and Enterprise Admins. The Domain Admins should only be admins in DomA, not DomB. Enterprise Admins will be administrators in both domains. The problem about Enterprise Admins is solved by adding the DomA Enterprise Admins group to the built-in Administrators group in DomB, so users in this group can administer Domain B from Domain A with no problem. But there is one BIG security hole here:

Domain A Domain Admins can add themselves to the Domain A Enterprise Admins group and become admins of domain B too.

Is there a way to secure those things somehow?

Answer 1

Your solution is to create dedicated administrative accounts in DomB for the selected users from DomA to use to administer DomB.

This prevents a compromise in DomA from affecting DomB, and it prevents those requiring Domain Admin access in DomA from gaining access to DomB.

---

Now, you could

• Create a new security group "DomB Admins" or something (with no privileged access in DomA) that can be used to delegate requisite access in DomB.
• You can secure the group "DomB Admins" with appropriate modifications to the ACL to prevent DomA\Domain Admins from modifying the group membership

Admittedly, this second option will be somewhat pointless, as Domain Admins will be able to change the ACL on the group in question. And if the new group is secured against Domain Admin modification, a Domain Admin can take ownership of the group and change the ACL.

In theoretical terms, this concern should be relatively unfounded because only users that absolutely require Domain Admin access should be members of the Domain Admins group (more on that later). Further, modifications of administrative groups should be monitored, reviewed, and audited.

So, as it currently exists, your biggest security hole is the fact that you have accounts in the Domain Admins group that may not (by your question) belong there. Your second biggest security hole would be the fact that a compromise of one forest automatically compromises the second forest.

When one finds oneself asking the question "how do I limit Domain Admin access," or "how do I secure a resource against modification by Domain Admins," there exists a misconfiguration. Because they are not designed to be limited.